7MS #463: DIY Pentest Dropbox Tips - Part 5
7 Minute Security14 Apr 2021

7MS #463: DIY Pentest Dropbox Tips - Part 5

In the last two episodes of this series (#449 and #450) we've been diving into how to not only speed up the process of spinning up a DIY pentest dropbox, but how to automate nearly the entire build process!

In today's episode we talk specifically about how to streamline the Windows 10 build process. As previously mentioned, this article is awesome for creating a core Win 10 answer file that will format C:, setup a local admin, login once to the configured desktop and then do whatever things you want it to do. Personally, I like having a single batch file get fired off that:

  • Sets the timezone with tzutil /s "Central Standard Time"

  • Stops the VM from falling asleep with powercfg.exe -change -standby-timeout-ac 0

  • Grabs and runs a PS file that does a ton of downloading and unzipping of files with:

invoke-webrequest https://somesite/somefile.zip -outfile c:\somewhere\somefile.zip expand-archive c:\somewhere\somefile.zip -destinationpath "c:\somewhere\extracted\"
  • Installs Windows updates with:
Install-PackageProvider -name nuget -force Install-Module PSWindowsUpdate -force Import-Module PSWindowsUpdate Get-WindowsUpdate Install-WindowsUpdate -AcceptAll -IgnoreReboot
  • Sets a new name for the machine:
Write-Host "Picking a new name for this machine...you'll need to provide your admin pw to do so" Rename-Computer -LocalCredential administrator -PassThru Write-Host "New name accepted!"
  • Does a set of actions depending on the IP range with this code (which sets the IP address to a variable and then does stuff if the machine sits in that subnet):
$ip = ((ipconfig | findstr [0-9].\.)[0]).Split()[-1] f ($ip -like "192.168.0.*") { Invoke-Webrequest https://somesite/somefile.ps1 -OutFile c:\someplace\somefile.ps1 }

Also, I talk in this episode about how I try to host these "seed" files as securely as possible using Amazon Lightsail instances, the built-in firewall, and LetsEncrypt.

Avsnitt(719)

7MS #462: Pentesting with the Hak5 Key Croc

7MS #462: Pentesting with the Hak5 Key Croc

Today we talk through our first engagement using Hak5 Key Croc to steal and exfil data. In the past, my internal monologue when a new Hak5 toy is released sounds like this: "I certainly don't need a...

7 Apr 202137min

7MS #461: Tales of Internal Network Pentest Pwnage - Part 26

7MS #461: Tales of Internal Network Pentest Pwnage - Part 26

OK I probably say this every time, but I'm gonna say it again: this tale of pwnage is my one of my favs - and not because of the tools/tradecraft, but because of why the company needed our help in the...

31 Mars 202147min

7MS #460: Why I'm Throwing My UniFi Gear Into the Ocean

7MS #460: Why I'm Throwing My UniFi Gear Into the Ocean

Hey friends! Warning: this is not a "typical" 7MS episode where we try hard to deliver some level of security value. Instead, today is a big, fat, crybaby, first-world problems whine-fest about how I ...

24 Mars 202140min

7MS #459: Cyber News - Microsoft Exchange Makes the World Cry Edition

7MS #459: Cyber News - Microsoft Exchange Makes the World Cry Edition

Happy mid-March! Our good pal Gh0sthax joins us today for another hot dish of cyber news! Stories include: Microsoft Exchange cyber attack - Hacker News has a nice what we know so far story, but thi...

17 Mars 20211h 3min

7MS #458: Interview with Tanya Janca

7MS #458: Interview with Tanya Janca

Today we're super excited to share a featured interview with Tanya Janca of WeHackPurple! Tanya has been in software development from the moment she was of legal age to work in Canada - beginning by w...

11 Mars 202159min

7MS #457: Tales of Internal Network Pentest Pwnage - Part 25

7MS #457: Tales of Internal Network Pentest Pwnage - Part 25

Hi! This episode of pentest pwnage is a fun one because it was built for speeeeeeeeeeeeeeeed. Here's some of the things we're doing/running when time is of the essence: Get a cmd.exe spun up in the c...

4 Mars 202131min

7MS #456: Certified Red Team Professional - Part 4

7MS #456: Certified Red Team Professional - Part 4

Hello friends!  Today, Joe (Gh0sthax) and I complete our series on CRTP - Certified Red Team Professional - a really awesome pentesting training and exam based squarely on Microsoft tools and tradecra...

25 Feb 202156min

Populärt inom Politik & nyheter

aftonbladet-krim
rss-krimstad
svenska-fall
p3-krim
spar
aftonbladet-daily
flashback-forever
politiken
rss-sanning-konsekvens
rss-krimreportrarna
motiv
rss-vad-fan-hande
blenda-2
rss-flodet
rss-frandfors-horna
rss-expressen-dok
grans
rss-aftonbladet-krim
svd-ledarredaktionen
ett-rent-noje